| Vulnerability Name: | CVE-2005-2471 (CCN-21500) | ||||||||||||||||||||
| Assigned: | 2005-07-24 | ||||||||||||||||||||
| Published: | 2005-07-24 | ||||||||||||||||||||
| Updated: | 2017-10-11 | ||||||||||||||||||||
| Summary: | pstopnm in netpbm does not properly use the "-dSAFER" option when calling Ghostscript to convert a PostScript file into a (1) PBM, (2) PGM, or (3) PNM file, which allows external user-assisted attackers to execute arbitrary commands. | ||||||||||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||
| Vulnerability Type: | CWE-Other | ||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Fri Aug 05 2005 - 05:44:32 CDT Netpbm: Arbitrary code execution in pstopnm Source: CCN Type: Debian Bug report logs - #319757 netpbm: arbitrary postscript code execution Source: MISC Type: UNKNOWN http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=319757 Source: MITRE Type: CNA CVE-2005-2471 Source: CCN Type: Conectiva Linux Security Announcement CLSA-2005:1007 Insecure temporary file creation Source: CCN Type: Netpbm Web site Netpbm home page Source: CCN Type: RHSA-2005-743 netpbm security update Source: CCN Type: SA16184 netpbm Arbitrary Postscript Code Execution Vulnerability Source: SECUNIA Type: Vendor Advisory 16184 Source: SECUNIA Type: Vendor Advisory 18330 Source: SECUNIA Type: Vendor Advisory 19436 Source: CCN Type: SECTRACK ID: 1014752 netpbm `pstopnm` Lack of Ghostscript -dSAFER Option May Let Remote Users Cause Arbitrary Commands to Be Executed Source: SECTRACK Type: UNKNOWN 1014752 Source: DEBIAN Type: UNKNOWN DSA-1021 Source: DEBIAN Type: DSA-1021 netpbm-free -- insecure program execution Source: CCN Type: GLSA-200508-04 Netpbm: Arbitrary code execution in pstopnm Source: SUSE Type: UNKNOWN SUSE-SR:2005:019 Source: OSVDB Type: UNKNOWN 18253 Source: CCN Type: OSVDB ID: 18253 Netpbm pstopnm Arbitrary Postscript Code Execution Source: REDHAT Type: UNKNOWN RHSA-2005:743 Source: BID Type: UNKNOWN 14379 Source: CCN Type: BID-14379 NetPBM PSToPNM Arbitrary Code Execution Vulnerability Source: TRUSTIX Type: Vendor Advisory 2005-0038 Source: CCN Type: TLSA-2005-90 Vulnerability exists in netpbm Source: CCN Type: USN-164-1 netpbm vulnerability Source: XF Type: UNKNOWN netpbm-dsafer-command-execution(21500) Source: XF Type: UNKNOWN netpbm-dsafer-command-execution(21500) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:11645 Source: SUSE Type: SUSE-SR:2005:019 SUSE Security Summary Report | ||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration RedHat 1:  Denotes that component is vulnerable | ||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||
| |||||||||||||||||||||
| BACK | |||||||||||||||||||||